There are multiple potential issues in the above code mentioned:

1. The CAST syntax is incorrect:

WHERE CAST user_id = CAST(:tenantId AS uuid)

The correct syntax is as follows:

WHERE user_id = CAST(:tenantId AS uuid)
 OR
WHERE user_id::uuid = :tenantId::uuid

2. The tenantId being a string:

Even if tenantId is indeed a valid uuid, it is coming from req.params, which is always a string in JavaScript. I would suggest you to validate the tenantId before passing it into the query by using regex or a npm package.

You can check the following links:

https://www.npmjs.com/package/uuid#uuidvalidatestr

How to test valid UUID/GUID?